our privacy policy

This Privacy Policy explains how VYB Software Limited, trading as Pathway ("Pathway", "we", "us" or "our"), collects, uses, stores and protects personal data when you visit our website, contact us, use our software, receive support, or otherwise interact with us.

Pathway is a live software platform that provides software and related services for dental practices, including tools for clinical documentation, patient communications, task management, treatment planning, consent workflows, practice administration, compliance and HR workflows, and AI-assisted productivity features.

We are committed to protecting personal data and complying with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, the Privacy and Electronic Communications Regulations 2003 ("PECR"), and other applicable UK data protection laws.

This Privacy Policy explains what we do with personal data where we act as a controller. Where we process personal data on behalf of a dental practice or other customer through the Pathway platform, we usually act as a processor, and the customer remains responsible for explaining that processing to its own patients, staff and users.

1. Who we are

• Organisation: VYB Software Limited
• Trading name / product name: Pathway
• Company number: 16552618
• Registered office: 24 Maldon Road, Chelmsford, United Kingdom, CM3 4QH
• Main business address: 24 Maldon Road, Chelmsford, United Kingdom, CM3 4QH
• Website: https://pathway.dental
• Email: privacy@pathway.dental

For data protection queries or complaints, please contact Jonathan Beacher, Data Protection Officer, at privacy@pathway.dental.

2. Important distinction: controller and processor roles

Pathway may act in different roles depending on the personal data involved.

2.1 Where Pathway acts as a controller

We are usually the controller for personal data relating to:

• visitors to our website;
• people who submit enquiries, request information, or contact us;
• prospective customers and business contacts;
• customers' business contacts, practice owners, administrators and authorised users;
• account administration, billing, subscriptions and customer relationship management;
• direct marketing and sales communications;
• product and service communications;
• service telemetry and technical information about how our services are used, where this is not customer-controlled patient, clinical or HR content;
• recruitment, supplier and business administration data;
• security logs and records used to protect our platform and business.

When we act as controller, we decide why and how that personal data is used.

2.2 Where Pathway acts as a processor

Where a dental practice or other customer uses Pathway to process personal data about its patients, staff, clinicians, contacts or practice operations, that customer is usually the controller and Pathway is usually the processor.

This may include, depending on the features used:

• patient names and contact details;
• clinical notes;
• treatment plans;
• consent records;
• appointment-related information;
• compliance records;
• HR records;
• staff training records;
• sickness and absence information;
• policies, checklists and audits;
• tasks and workflow records;
• patient communications;
• email and SMS communications;
• communication preferences and opt-out records;
• uploaded documents, images, transcripts or other practice data;
• other information entered into or generated through the Pathway platform.

Where we act as processor, we process that data only on the customer's documented instructions and in accordance with our contract and Schedule 1: Data Processing Agreement.

If you are a patient or employee of an organisation using Pathway, that organisation is normally responsible for your personal data. You should usually contact that organisation directly if you want to exercise your data protection rights in relation to information it holds about you.

3. Personal data we collect

The personal data we collect depends on how you interact with us.

3.1 Website and enquiry data

When you visit our website, complete a form, request information, or contact us, we may collect:

• your name;
• email address;
• telephone number;
• job title or role;
• organisation or practice name;
• business address;
• website address;
• information you choose to include in your message;
• source information, such as how you found us;
• technical information such as IP address, browser type, device information, pages visited, referral source, and approximate location.

3.2 Customer account and user data

When a practice or organisation becomes a Pathway customer, we may collect:

• names and contact details of practice owners, managers, administrators and authorised users;
• login credentials and authentication information;
• user roles, permissions and audit logs;
• subscription, contract and billing information;
• payment status and invoicing records;
• support requests, feedback and correspondence;
• training, onboarding and implementation notes;
• usage information needed to administer, secure and improve the service.

3.3 Support and communications data

If you contact us for support or communicate with us, we may collect:

• your name and contact details;
• the content of your support request or message;
• screenshots, files, logs or other materials you provide;
• call, meeting or chat notes;
• information needed to investigate and resolve the issue.

Google Workspace / Gmail is used for Pathway business email, including sales enquiries, practice support questions and general business administration.

Google Workspace / Gmail is not used as a primary storage location for customer platform data or patient clinical records.

Please avoid sending patient-identifiable or special category data to our general support channels unless it is necessary, authorised and appropriate.

3.4 Platform data processed on behalf of customers

Depending on how a customer configures and uses Pathway, the platform may process personal data uploaded, entered, transmitted or generated by that customer.

This may include special category data, including health data.

For this category of data, the customer is usually the controller and Pathway is usually the processor.

3.5 AI, LLM, audio, transcription and automation data

Where customers use AI-assisted features, voice dictation, transcription, summarisation, clinical note generation, letter drafting, workflow automation or other AI functionality, relevant input and output data may include:

• audio streams;
• transcriptions;
• clinical notes;
• prompts and instructions;
• generated drafts, summaries or suggestions;
• metadata needed to provide and secure the feature;
• user review, acceptance or editing actions.

Pathway uses AssemblyAI for streaming speech-to-text transcription through its EU endpoint.

Pathway does not retain original audio after transcription.

Pathway uses OpenRouter as an AI infrastructure provider for LLM requests.

Before an LLM query is transmitted to OpenRouter, Pathway applies data minimisation and automated redaction to remove personally identifiable information and patient-identifiable information from the query.

OpenRouter is not intended to receive patient-identifiable information through Pathway's LLM functionality.

OpenRouter may route redacted LLM requests to selected third-party model providers in order to generate a response.

Pathway does not use patient-identifiable information for AI training, fine-tuning, model evaluation, model quality assurance or human review for those purposes.

Authorised Pathway personnel may access customer data where reasonably necessary to provide support requested by the customer, investigate security or technical incidents, comply with legal obligations, or otherwise act on the customer's documented instructions.

3.6 Customer email communications

Where a customer uses Pathway to send transactional or marketing emails, Pathway may process:

• recipient names;
• email addresses;
• message content;
• communication preferences;
• unsubscribe or suppression information;
• delivery status;
• bounce information;
• spam complaint information;
• other technical communication metadata.

Pathway uses Postmark to provide transactional and marketing email delivery on behalf of customers.

For these communications, the customer normally acts as controller, Pathway acts as processor, and Postmark acts as a sub-processor.

Customers are responsible for ensuring that communications sent through Pathway have an appropriate lawful basis and comply with applicable direct marketing and electronic communications law.

Pathway provides functionality that enables customers and end users to manage relevant communication and marketing preferences.

3.7 Cookies and similar technologies

We may use essential cookies and similar storage technologies that are necessary to operate, authenticate, secure and maintain our website and platform.

We do not currently use tracking pixels in Pathway's own marketing communications.

Where we introduce non-essential cookies or similar technologies, we will provide appropriate information and obtain consent where required by law.

Further information about cookies used on this website is available in our Cookie Policy.

4. How we collect personal data

We collect personal data in several ways.

4.1 Directly from you

We may collect personal data directly when you:

• visit or use our website;
• complete a contact or enquiry form;
• request a demonstration or information about Pathway;
• create or use an account;
• enter into a customer contract;
• contact sales or support;
• communicate with us by email, telephone, SMS or other channels;
• change communication or marketing preferences.

4.2 From our customers

Our customers may provide personal data when they:

• create accounts for authorised users;
• configure the Pathway platform;
• import or enter practice data;
• use clinical, compliance, HR or communications functionality;
• upload contact or communication information;
• send transactional or marketing communications;
• contact us for technical or operational support.

Where the customer provides patient, employee or other third-party personal data, Pathway will usually process that data as the customer's processor.

4.3 Automatically

We may automatically collect limited technical and operational information through:

• application logs;
• authentication records;
• security logs;
• device and browser information;
• IP addresses;
• system events;
• service usage information;
• performance and diagnostic telemetry.

We use this information primarily to operate, secure, troubleshoot and maintain Pathway.

4.4 From public and third-party business sources

For business development and direct marketing, we may obtain business contact information from publicly available or professional sources, including:

• Companies House;
• professional or practice websites;
• LinkedIn and other professional networks;
• publicly available business directories;
• referrals and introductions;
• industry events or professional contacts.

This may include an individual's name, professional role, practice or organisation, business email address, business telephone number and other publicly available professional information.

Where we obtain personal data from another source rather than directly from the individual, we provide the information required by data protection law within the applicable timeframe unless an exemption applies.

We do not purchase or use consumer marketing databases for patient marketing.

5. How we use personal data and our lawful bases

We only use personal data where we have a lawful basis to do so.

5.1 To respond to enquiries and provide information

We use enquiry data to respond to requests, provide information, arrange demonstrations and answer questions.

Lawful basis: legitimate interests, and in some circumstances steps taken at your request before entering into a contract.

Our legitimate interest is responding to people who contact us and developing business relationships with organisations interested in Pathway.

5.2 To provide and administer our services

We use customer account and user data to:

• create and administer accounts;
• manage subscriptions;
• provide the platform;
• authenticate users;
• deliver onboarding;
• provide customer support;
• maintain service records;
• communicate important service information.

Lawful basis: contract, legitimate interests and legal obligation where applicable.

5.3 To process customer data through the Pathway platform

Where we process customer-controlled data, including patient data, clinical data, compliance records, HR records, communications or practice workflow data, we do so to provide the services selected by the customer.

Role: usually processor acting on the customer's instructions. Customer's lawful basis: determined by the customer as controller.

5.4 To provide AI-assisted, transcription and automation features

We process relevant input and output data to provide features such as:

• speech-to-text transcription;
• summarisation;
• drafting;
• classification;
• clinical note assistance;
• workflow suggestions;
• automation.

For LLM functionality, Pathway removes personally identifiable information and patient-identifiable information from queries before transmission to OpenRouter.

Lawful basis where Pathway is controller: contract and legitimate interests. Role for customer-controlled data: usually processor acting on the customer's instructions.

5.5 To provide customer support and resolve issues

We use support data to investigate issues, respond to requests, maintain reliability and maintain appropriate records of support interactions.

Lawful basis: contract and legitimate interests.

Our legitimate interest is providing effective support, maintaining service quality and resolving technical or operational issues.

5.6 To operate, improve, secure and monitor our services

We use technical, diagnostic, operational, security and usage information to:

• operate and maintain Pathway;
• monitor service performance;
• prevent fraud, misuse and unauthorised access;
• investigate security incidents;
• diagnose and correct errors;
• understand technical feature usage;
• improve usability and reliability;
• develop and test new functionality.

For general product improvement, we use service telemetry, operational metrics, aggregated information and appropriately de-identified information.

We do not use identifiable patient clinical content or employee HR content for general product improvement, analytics, AI training, model development or model evaluation unless the processing is carried out on the customer's documented instructions for a specific purpose.

Lawful basis: legitimate interests, contract where necessary to provide the service, and legal obligation where applicable.

Our legitimate interests include operating a reliable and secure software service, preventing misuse, understanding technical service performance and improving the functionality and usability of Pathway.

5.7 To send service communications

We may send administrative and service communications, such as:

• security notices;
• account notifications;
• billing notices;
• support updates;
• changes to terms;
• important product or operational notices;
• information necessary to administer a Pathway account.

These are not treated as optional marketing where their content is necessary for the provision, security or administration of the service.

Lawful basis: contract, legitimate interests and legal obligation where applicable.

5.8 Direct marketing and business development

Pathway carries out direct marketing and business development activities.

We may use business contact information to communicate about:

• Pathway products and services;
• new functionality;
• demonstrations;
• relevant resources;
• events;
• offers;
• other information that we reasonably believe may be relevant to the recipient's professional role or organisation.

Marketing may be sent through email, SMS, telephone or other professional communication channels where permitted by law.

For business-to-business marketing to corporate contacts, we may rely on our legitimate interests where permitted.

Where PECR or other applicable law requires consent, we will obtain consent or rely on another legally permitted mechanism, such as the soft opt-in where applicable.

We do not disguise our identity when sending direct marketing.

Every recipient has a clear right to opt out of direct marketing at any time.

Customers and end users can manage marketing and communication preferences through the preference controls made available by Pathway and may also opt out using an unsubscribe mechanism, replying to a message where appropriate, or contacting privacy@pathway.dental.

We maintain suppression or do-not-contact records where necessary to ensure that marketing preferences continue to be respected.

Opting out of marketing does not prevent us from sending service communications that are necessary to operate, secure or administer an account.

Lawful basis: legitimate interests or consent, depending on the recipient, communication channel and applicable legal requirements.

Our legitimate interest is promoting Pathway to organisations and professional contacts who may reasonably be interested in our products and services.

5.9 Customer transactional and marketing communications

Where customers use Pathway to send transactional or marketing emails, Pathway processes the relevant recipient information and message content on behalf of the customer.

Pathway uses Postmark as a sub-processor to deliver those emails.

The customer remains responsible for:

• determining the purpose and audience of the communication;
• establishing an appropriate lawful basis;
• complying with PECR and other direct marketing requirements;
• maintaining appropriate communication preferences;
• honouring objections and opt-out requests.

Pathway provides functionality to support communication preferences, unsubscribe choices and suppression of recipients where appropriate.

5.10 To manage billing, accounts and finance

We use relevant data to:

• issue invoices;
• process payments;
• manage subscriptions;
• maintain accounting records;
• deal with financial administration.

Lawful basis: contract, legal obligation and legitimate interests.

5.11 To comply with legal and regulatory obligations

We may process data to comply with:

• legal duties;
• regulatory requirements;
• court orders;
• tax and accounting obligations;
• law enforcement requests;
• data protection obligations.

Lawful basis: legal obligation and legitimate interests where applicable.

5.12 To protect our rights and business

We may process data to:

• enforce contracts;
• establish, exercise or defend legal claims;
• prevent fraud;
• protect our intellectual property;
• manage disputes;
• protect Pathway, our customers and users.

Lawful basis: legitimate interests and legal obligation where applicable.

5.13 Our legitimate interests

Where we rely on legitimate interests, those interests may include:

• operating and securing Pathway;
• responding to business enquiries;
• providing effective customer support;
• maintaining service reliability;
• preventing fraud, misuse and security incidents;
• developing commercial relationships;
• carrying out proportionate business-to-business marketing;
• understanding technical service performance;
• improving the usability and functionality of Pathway using appropriate technical, aggregated or de-identified information;
• protecting our legal rights;
• managing disputes.

Where required, we balance these interests against the rights, freedoms and reasonable expectations of the individuals concerned.

6. Special category, HR and criminal offence data

6.1 Special category data

Special category data includes personal data concerning:

• health;
• genetics;
• biometric data used for identification;
• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade union membership;
• sex life;
• sexual orientation.

Pathway is designed for dental and healthcare-related workflows, so customer-controlled data may include health information.

Pathway's HR functionality may also contain employment information, including information relating to attendance, sickness, absence, occupational health or workplace adjustments.

Some of this information may constitute health data and therefore special category data.

Where we process special category data on behalf of a customer, we usually do so as processor under the customer's documented instructions.

The customer is responsible for identifying its relevant Article 6 lawful basis and, where applicable, the relevant Article 9 condition for its processing.

Where Pathway processes special category data as controller, we will only do so where we have both an appropriate lawful basis and an applicable Article 9 condition.

6.2 HR data

Pathway's compliance and HR capabilities may process customer-controlled employee and workforce information such as:

• employee names and contact information;
• job roles;
• working patterns and rotas;
• attendance information;
• sickness and absence records;
• leave information;
• training and competency records;
• compliance records;
• employment documentation;
• performance or management records entered by the customer.

The customer remains responsible for determining the lawful basis, retention period, access controls and appropriate use of employee information stored through Pathway.

6.3 Criminal offence data

Pathway is not designed to store personal data relating to criminal convictions and offences or related security measures within the meaning of Article 10 UK GDPR.

This includes information about:

• criminal convictions;
• alleged criminal offences;
• criminal investigations or proceedings;
• DBS or criminal record check information;
• cautions or similar criminal justice measures.

Customers must not use Pathway's HR or other functionality to upload or maintain Article 10 criminal offence data.

If such data is inadvertently entered into Pathway, the customer should remove it and contact Pathway where assistance is required.

7. Children's data

Pathway may process information relating to child patients where a dental practice uses the platform for that purpose.

In that context, the customer is usually the controller and Pathway is usually the processor.

Pathway's own website and business services are not intended for children, and we do not knowingly collect children's personal data for our own marketing or account administration purposes.

8. Who we share personal data with

We may share or make personal data available to service providers where necessary to operate Pathway and our business.

These providers may include:

• cloud hosting and infrastructure providers;
• database, storage and backup infrastructure;
• AI and LLM infrastructure providers;
• transcription and speech-to-text providers;
• email delivery providers;
• email providers;
• SMS and communications providers;
• DNS providers;
• payment processors;
• professional advisers;
• regulators, public authorities, courts or law enforcement where required by law.

Where a provider acts as our processor or sub-processor, we require appropriate contractual data protection obligations.

8.1 Current suppliers and sub-processors

Our current key suppliers include:

• DigitalOcean for Pathway application server hosting in London, United Kingdom;
• Hetzner for EEA-based server infrastructure;
• Cloudflare for DNS and domain infrastructure;
• Twilio for SMS routing and communications infrastructure;
• Postmark for transactional and marketing email delivery on behalf of Pathway customers;
• AssemblyAI for streaming speech-to-text transcription;
• OpenRouter for LLM infrastructure and routing;
• Stripe for practice subscription, billing and payment processing;
• Google Workspace / Gmail for Pathway sales, support and general business email.

Our current customer-data sub-processors include:

• DigitalOcean;
• Hetzner;
• Cloudflare, limited to DNS-related processing;
• Twilio;
• Postmark;
• AssemblyAI;
• OpenRouter.

8.2 DigitalOcean

DigitalOcean provides Pathway's application server infrastructure.

Our Pathway application servers are hosted in London, United Kingdom.

8.3 Hetzner

Hetzner provides additional server infrastructure hosted in the EEA.

8.4 Cloudflare

Cloudflare is used as a sub-processor for DNS and domain infrastructure only.

Pathway does not use Cloudflare to proxy or inspect Pathway application payloads, clinical records or HR content.

Cloudflare's role is limited to DNS-related infrastructure and associated technical metadata necessary to provide that service.

Cloudflare is not a primary or secondary storage location for Pathway customer records.

8.5 Twilio

Twilio is used to provide SMS routing and communications functionality.

Where a customer uses SMS functionality through Pathway, Twilio may process information required to transmit the communication, which can include:

• recipient telephone numbers;
• sender information;
• message content;
• communications metadata;
• delivery status information.

Telecommunications providers and network operators may also process communications as necessary to deliver messages.

8.6 Postmark

Postmark is used as a sub-processor to deliver transactional and marketing emails sent by customers through Pathway.

Depending on the communication sent, Postmark may process:

• recipient names;
• recipient email addresses;
• sender details;
• email subject lines;
• email message content;
• message identifiers;
• delivery status information;
• bounce information;
• spam complaints;
• suppression information;
• technical message metadata.

Postmark may also process message activity information where relevant to the delivery and operation of its email service.

Pathway customers remain responsible for the lawfulness of the email communications they choose to send through Pathway.

Pathway provides communication preference and opt-out functionality to help customers manage recipient choices.

8.7 AssemblyAI

AssemblyAI is used as a sub-processor for streaming speech-to-text transcription.

Pathway uses AssemblyAI's EU endpoint for streaming transcription.

Pathway does not retain the original audio stream after transcription.

Pathway does not permit patient-identifiable audio or transcripts to be used for AI model training, fine-tuning, model evaluation or model quality assurance.

Limited technical metadata may be retained by AssemblyAI where required for logging, billing, security or service operation.

8.8 OpenRouter and LLM processing

OpenRouter is used as a sub-processor to provide LLM infrastructure and route LLM requests to selected model providers.

Before an LLM query is sent to OpenRouter, Pathway removes personally identifiable information and patient-identifiable information from the query.

OpenRouter therefore receives redacted and data-minimised query content rather than patient-identifiable information through Pathway's intended workflow.

OpenRouter may transmit the redacted query to a selected third-party model provider to generate an output.

Pathway selects and configures AI services with privacy and data minimisation in mind and does not intentionally transmit patient-identifiable information to OpenRouter or downstream LLM providers.

OpenRouter may separately process limited account, API, security and service usage metadata necessary to provide its services.

8.9 Stripe

Stripe is used for practice subscription, billing and payment processing.

Stripe may process:

• practice subscription details;
• billing contacts;
• payment information;
• transaction information;
• related account and payment metadata.

Stripe is not used by Pathway to process patient clinical records.

8.10 Google Workspace / Gmail

Google Workspace / Gmail is used for:

• sales enquiries;
• customer support questions;
• general business administration;
• internal business email.

Google Workspace / Gmail is not used as a primary storage location for customer platform data or patient clinical records.

Pathway users should not send patient-identifiable clinical records through general email channels unless necessary, authorised and appropriate.

8.11 Professional, regulatory and corporate disclosures

We may also disclose relevant personal data to:

• lawyers;
• accountants;
• auditors;
• insurers;
• regulators;
• public authorities;
• courts;
• law enforcement agencies where legally required;
• potential buyers, investors or advisers in connection with an investment, restructuring, merger or sale of the business.

9. International transfers

Pathway's application server infrastructure is hosted by DigitalOcean in London, United Kingdom.

Pathway's wider primary hosting is in the UK and EEA, including infrastructure provided by Hetzner.

Some suppliers may involve processing outside the UK or EEA for limited purposes.

9.1 Twilio

Twilio may process communications and related account or service information internationally depending on the services, network routes and telecommunications providers involved.

Where UK personal data is transferred internationally, Twilio's applicable data processing terms provide mechanisms for international transfers, including recognised transfer frameworks and the UK international transfer arrangements applicable to its services.

9.2 Postmark

Postmark is a US-based email delivery service and may process and store email message content, recipient information and related message metadata in the United States.

Postmark is used where customers choose to send transactional or marketing email through Pathway.

Postmark provides contractual data protection arrangements, including a data processing agreement and mechanisms for regulated international transfers.

Where required for transfers of UK personal data, appropriate UK transfer safeguards are used, including the UK International Data Transfer Addendum or another valid transfer mechanism.

9.3 Stripe

Stripe may process practice subscription, billing, payment and related account data outside the UK and EEA.

Where this occurs, Stripe relies on appropriate international transfer safeguards under its applicable contractual and data processing arrangements.

9.4 Google Workspace / Gmail

Google may process business email account, communication and related service information outside the UK and EEA depending on the relevant Google Workspace configuration and service operation.

Google Workspace / Gmail is used for Pathway business communications, not as a primary repository for customer platform data or clinical records.

9.5 Cloudflare

Cloudflare operates internationally.

Pathway's use of Cloudflare is limited to DNS and associated domain infrastructure.

Cloudflare does not proxy or inspect Pathway application content under our intended configuration.

Any international processing is therefore limited to DNS-related and associated technical information relevant to that service.

9.6 AssemblyAI

Pathway uses AssemblyAI's EU endpoint for streaming speech-to-text transcription so that transcription processing is performed within the European Union.

Limited account, security, operational, billing or technical metadata may be processed internationally where necessary to operate the service.

9.7 OpenRouter

OpenRouter is a US-based provider and may process limited account, API, security and service usage information outside the UK and EEA.

Pathway removes personally identifiable information and patient-identifiable information from LLM queries before transmission to OpenRouter.

OpenRouter may route redacted query content to selected third-party model providers.

Where OpenRouter processes personal data on our behalf, its applicable data processing terms provide contractual safeguards for international transfers, including provisions addressing UK data transfers.

9.8 Transfer safeguards

Where personal data is transferred internationally, we use appropriate safeguards where required by law.

Depending on the provider and destination, these may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to the EU Standard Contractual Clauses;
• EU Standard Contractual Clauses where relevant;
• recognised data transfer frameworks;
• contractual and technical safeguards;
• transfer risk assessments where required.

You may contact privacy@pathway.dental for further information about safeguards relevant to a particular international transfer.

10. How long we keep personal data

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy, including to provide services, comply with legal obligations, maintain security, resolve disputes, enforce agreements, and support audit or regulatory requirements.

Retention periods depend on the data, purpose, legal requirements and whether Pathway acts as controller or processor.

10.1 Retention where Pathway acts as controller

We may retain information for longer where necessary for legal claims, investigations, regulatory requirements or another lawful reason.

10.2 Customer email delivery data

Where customers send transactional or marketing email through Pathway, Postmark processes message content and activity information as a sub-processor.

Postmark's standard retention period for email content and related activity data is currently 45 days unless a different retention period is configured.

Postmark may retain certain suppression, bounce, spam complaint or aggregated statistical information for longer where necessary to operate its service, maintain sending reputation or comply with its legal and operational requirements.

Customer-controlled records retained within Pathway remain subject to the customer's own retention instructions and applicable contractual arrangements.

10.3 Audio recordings and transcription data

Pathway does not retain original audio after transcription.

Audio is processed using AssemblyAI for streaming speech-to-text transcription through AssemblyAI's EU endpoint.

The audio stream is used to generate transcription output and is not stored by Pathway as an audio recording.

Transcripts, clinical notes, summaries or other outputs may be retained within Pathway where the customer chooses to retain them as part of its records.

The customer determines the appropriate retention period for those customer-controlled records.

10.4 Customer-controlled platform data

Where a customer uses Pathway to process patient records, clinical notes, treatment plans, consent records, communications, compliance records, HR records, tasks or other practice data, Pathway usually acts as processor.

The customer is responsible for determining how long those records should be retained.

We process, retain, delete or return that data in accordance with:

• the customer's documented instructions;
• the customer contract;
• Schedule 1: Data Processing Agreement;
• applicable legal and professional obligations.

10.5 Deletion after account closure

When a customer account is terminated, customer-controlled platform data will usually be deleted or put beyond normal use within 30 days unless:

• the customer requests an export, return or permitted extended retention;
• the contract or Schedule 1: Data Processing Agreement provides otherwise;
• we are legally required to retain particular information;
• information needs to be preserved for an existing security investigation, dispute or legal claim;
• residual copies remain within the normal backup cycle.

Residual backup copies are normally deleted or overwritten within 90 days.

10.6 Legal holds and exceptions

We may retain personal data for longer where necessary to:

• comply with legal or regulatory obligations;
• investigate security incidents;
• resolve disputes;
• enforce contracts;
• establish, exercise or defend legal claims;
• comply with court orders or lawful regulatory requests.

When information is no longer required, we delete it, anonymise it, or put it beyond normal use.

11. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include, as appropriate:

• role-based access controls;
• authentication controls;
• encryption in transit;
• encryption at rest where appropriate;
• audit logging;
• secure cloud infrastructure;
• backups and disaster recovery processes;
• vulnerability management and patching;
• staff confidentiality obligations;
• supplier due diligence;
• incident response processes;
• data minimisation;
• segregation of data;
• access restrictions based on operational need.

No information system can be guaranteed to be completely secure.

If you believe a Pathway account or information may have been compromised, contact privacy@pathway.dental.

12. AI-assisted features and human oversight

Pathway may include AI-assisted functionality to help users draft, summarise, classify, retrieve or structure information.

AI-generated outputs may be incomplete or inaccurate and may require professional review.

Customers and authorised users remain responsible for reviewing AI-assisted outputs before:

• relying on them;
• adding them to formal records;
• sending them to patients;
• using them for clinical decisions;
• using them for HR, compliance, legal or administrative decisions.

Pathway's AI functionality is intended to support human decision-making rather than replace professional judgement.

Where customer-controlled data is processed for an AI-assisted feature, we act in accordance with the customer's documented instructions and Schedule 1: Data Processing Agreement.

For LLM queries:

• Pathway applies automated redaction and data minimisation;
• personally identifiable information and patient-identifiable information are removed before transmission to OpenRouter;
• OpenRouter receives redacted query content;
• OpenRouter may route the query to selected model providers;
• Pathway does not intentionally transmit patient-identifiable information to OpenRouter or downstream model providers;
• patient-identifiable information is not used for AI training, fine-tuning, model evaluation or model quality assurance.

Authorised Pathway personnel may access customer data only where reasonably necessary to provide requested support, investigate an incident, comply with law or act on the customer's documented instructions.

13. Your data protection rights

Depending on the circumstances and our role, you may have rights including:

• the right to be informed about how your personal data is used;
• the right to access your personal data;
• the right to correct inaccurate personal data;
• the right to request erasure in certain circumstances;
• the right to restrict processing in certain circumstances;
• the right to object to processing in certain circumstances;
• the right to data portability in certain circumstances;
• rights relating to automated decision-making where applicable;
• the right to withdraw consent where processing is based on consent.

If you wish to exercise a right in relation to data for which Pathway is controller, contact privacy@pathway.dental.

Step-by-step instructions for requesting deletion, including a request that starts from Facebook, are on our Data deletion request page.

If your request relates to patient, employee, clinical or other customer-controlled records held through Pathway, you should usually contact the relevant dental practice or organisation directly.

Where we receive such a request and act as processor, we will assist the relevant customer in accordance with our contractual obligations.

13.1 Right to object

You have the right to object to certain processing carried out on the basis of legitimate interests.

You have an absolute right to object to the use of your personal data for direct marketing.

If you object to direct marketing, we will stop using your personal data for that purpose.

We may retain limited information on a suppression list so that we can continue to respect your preference and avoid contacting you again for direct marketing.

14. Data protection complaints

If you believe Pathway has not handled your personal data in accordance with data protection law, you have the right to make a data protection complaint directly to us.

You can make a complaint by contacting:

• Data Protection Officer: Jonathan Beacher
• Email: privacy@pathway.dental

We will:

• provide a clear way for you to raise a data protection complaint;
• acknowledge receipt of the complaint within 30 days;
• take appropriate steps to investigate the complaint without undue delay;
• make appropriate enquiries into the issues raised;
• keep you informed of progress where appropriate;
• communicate the outcome of our investigation without undue delay.

We may ask for additional information where reasonably necessary to understand or investigate the complaint.

You also have the right to complain to the Information Commissioner's Office (ICO).

• ICO website: https://ico.org.uk
• ICO telephone: 0303 123 1113

You do not need to complain to us before contacting the ICO, although giving us the opportunity to investigate may allow the matter to be resolved more quickly.

15. Direct marketing and communication preferences

Pathway may send direct marketing communications to prospective customers, customers and professional business contacts in accordance with applicable law.

Marketing may include information about:

• Pathway products and services;
• product functionality;
• offers;
• demonstrations;
• events;
• relevant resources;
• commercial updates.

We do not currently use tracking pixels in Pathway's own direct marketing emails.

15.1 Your marketing choices

You may opt out of direct marketing at any time.

Customers and end users can manage communication and marketing preferences using preference controls made available by Pathway.

You can also opt out by:

• using an unsubscribe link;
• replying to an email or message where an opt-out method is provided;
• updating available account or communication preferences;
• contacting privacy@pathway.dental.

We will act on marketing objections and opt-out requests promptly.

We may retain a limited suppression record to make sure your preference continues to be respected.

Marketing preferences do not prevent us from sending messages that are necessary for:

• account administration;
• security;
• billing;
• service availability;
• contractual notifications;
• customer support;
• other essential operational purposes.

15.2 Marketing sent by customers through Pathway

Customers may use Pathway to send their own transactional and marketing emails through Postmark.

In those circumstances, the customer is responsible for determining:

• who should receive the communication;
• whether marketing is lawful;
• whether consent or another PECR basis is required;
• whether an unsubscribe or other preference mechanism is required;
• how communication preferences should be managed.

Pathway provides technical functionality to support preference management, opt-out requests and suppression where configured.

16. Automated decision-making and profiling

Pathway does not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

Pathway may use automation and AI-assisted functionality to support users with:

• drafting;
• summarisation;
• classification;
• workflow suggestions;
• administrative assistance;
• information retrieval.

These features are intended to support human users and do not replace professional judgement or decision-making.

17. Customer responsibilities

Customers using Pathway are responsible for:

• ensuring they have a lawful basis for personal data entered into or processed through Pathway;
• identifying any relevant Article 9 condition for special category data;
• providing appropriate privacy information to patients, staff, clinicians and other individuals;
• configuring user permissions appropriately;
• ensuring authorised users use Pathway lawfully and securely;
• reviewing AI-assisted outputs before relying on them;
• complying with professional, clinical, employment, regulatory and record-keeping obligations;
• responding to individual rights requests where the customer is controller;
• determining appropriate retention periods for customer-controlled records;
• maintaining lawful communication and marketing preferences;
• ensuring transactional and marketing messages sent through Pathway comply with applicable data protection and electronic communications laws;
• ensuring data imported into Pathway is accurate, relevant and lawful;
• not using Pathway to store Article 10 criminal offence data.

This Privacy Policy does not replace the customer's own privacy notice to its patients, staff or users.

Where Pathway processes personal data on behalf of a customer, including patient records, clinical notes, treatment plans, consent records, communications, compliance records, HR records, task records or other practice data, Pathway usually acts as processor and the customer acts as controller.

This processing is governed by the customer contract and Schedule 1: Data Processing Agreement, which sets out:

• the parties' UK GDPR responsibilities;
• the customer's documented instructions;
• security obligations;
• confidentiality requirements;
• sub-processor arrangements;
• international transfer safeguards;
• data subject request assistance;
• data breach assistance;
• audit and compliance arrangements;
• data return and deletion arrangements.

18. Information you must provide to use Pathway

Certain personal data is necessary for us to enter into or perform a contract with a customer.

For example, we may require:

• account administrator details;
• authorised user information;
• authentication information;
• billing contact details;
• subscription information.

If required account or contractual information is not provided, we may be unable to create an account, enter into a contract, process a subscription or provide some Pathway services.

Where information is optional, we will not treat failure to provide it as preventing use of the service unless it is genuinely required for the relevant functionality.

19. Links and third-party services

Our website or platform may contain links to third-party websites, services or integrations.

We are not responsible for the privacy practices of independent third parties.

Where you choose to enable a third-party integration or service, you should review that provider's privacy information and contractual terms.

20. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to Pathway;
• changes to our suppliers or processing activities;
• changes to applicable law;
• regulatory guidance;
• changes to our business operations.

The current version will be published on our website or made available through the Pathway platform.

Where changes are material, we may take additional steps to notify affected customers or users, such as by email, in-app notice or contractual notification.

21. Contact us

If you have any questions, requests or complaints about this Privacy Policy or how Pathway handles personal data, please contact:

• VYB Software Limited / Pathway
• Data Protection Officer: Jonathan Beacher
• Email: privacy@pathway.dental
• Website: https://pathway.dental